Skip to content

Codesigning failing for 3.27 beta #157016

Closed
Closed
Codesigning failing for 3.27 beta#157016

Description

@christopherfujino
christopherfujino
opened on Oct 16, 2024

engine commit
build
logs

[INFO] codesign: Executing: /usr/bin/codesign --keychain build.keychain -f -s Developer ID Application: FLUTTER.IO LLC (S8QB4VV633) /Volumes/Work/s/w/ir/x/t/conductor_codesignBmgvmt/single_artifact/FlutterMacOS.xcframework/macos-arm64_x86_64/FlutterMacOS.framework --timestamp --options=runtime

Unhandled exception:
Exception: Failed to codesign binary or bundle at /Volumes/Work/s/w/ir/x/t/conductor_codesignBmgvmt/single_artifact/FlutterMacOS.xcframework/macos-arm64_x86_64/FlutterMacOS.framework with args: /usr/bin/codesign --keychain build.keychain -f -s Developer ID Application: FLUTTER.IO LLC (S8QB4VV633) /Volumes/Work/s/w/ir/x/t/conductor_codesignBmgvmt/single_artifact/FlutterMacOS.xcframework/macos-arm64_x86_64/FlutterMacOS.framework --timestamp --options=runtime
stdout:
stderr:
/Volumes/Work/s/w/ir/x/t/conductor_codesignBmgvmt/single_artifact/FlutterMacOS.xcframework/macos-arm64_x86_64/FlutterMacOS.framework: replacing existing signature
/Volumes/Work/s/w/ir/x/t/conductor_codesignBmgvmt/single_artifact/FlutterMacOS.xcframework/macos-arm64_x86_64/FlutterMacOS.framework: unsealed contents present in the root directory of an embedded framework
#0      FileCodesignVisitor.codesignAtPath.<anonymous closure> (package:codesign/src/file_codesign_visitor.dart:388)
<asynchronous suspension>
#1      RetryOptions.retry (package:retry/retry.dart:131)
<asynchronous suspension>
#2      FileCodesignVisitor.codesignAtPath (package:codesign/src/file_codesign_visitor.dart:381)
<asynchronous suspension>
#3      FileCodesignVisitor.visitDirectory (package:codesign/src/file_codesign_visitor.dart:289)
<asynchronous suspension>
#4      FileCodesignVisitor.visitDirectory (package:codesign/src/file_codesign_visitor.dart:264)
<asynchronous suspension>
#5      FileCodesignVisitor.visitDirectory (package:codesign/src/file_codesign_visitor.dart:264)
<asynchronous suspension>
#6      FileCodesignVisitor.visitDirectory (package:codesign/src/file_codesign_visitor.dart:264)
<asynchronous suspension>
#7      FileCodesignVisitor.processRemoteZip (package:codesign/src/file_codesign_visitor.dart:221)
<asynchronous suspension>
#8      FileCodesignVisitor.validateAll (package:codesign/src/file_codesign_visitor.dart:182)
<asynchronous suspension>

Activity

  1. christopherfujino
    added
    team-release
    on Oct 16, 2024

  2. christopherfujino commented on Oct 16, 2024

    @christopherfujino
    christopherfujino
    on Oct 16, 2024
    ContributorAuthor

    Per https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG312:

    codesign says I have 'unsealed content' somewhere.
    Do not put files or directories into the top directory of an app or framework bundle
    All content must be inside Contents or Versions respectively as described earlier.

  3. cbracken commented on Oct 16, 2024

    @cbracken
    cbracken
    on Oct 16, 2024
    Member

    Would be great if they told us what that content was -- is there a zip I can download to take a look?

  4. christopherfujino commented on Oct 16, 2024

    @christopherfujino
    christopherfujino
    on Oct 16, 2024
    ContributorAuthor

    I will work on trying to get you a zipped bundle

  5. christopherfujino commented on Oct 16, 2024

    @christopherfujino
    christopherfujino
    on Oct 16, 2024
    ContributorAuthor

    This should upload logs once codesiging fails: https://flutter-review.googlesource.com/c/recipes/+/60420

  6. christopherfujino commented on Oct 16, 2024

    @christopherfujino
    christopherfujino
    on Oct 16, 2024
    ContributorAuthor

    Ok, we have new release builds that we expect to fail again, but to upload the offending zipped archives: https://ci.chromium.org/ui/p/dart-internal/builders/flutter/Mac%20engine_release_builder/713/overview

  7. christopherfujino commented on Oct 17, 2024

    @christopherfujino
    christopherfujino
    on Oct 17, 2024
    ContributorAuthor

    Ok, it looks like the cause of codesigning failing is that there are unexpected .DS_Store files in the zip.

  8. christopherfujino commented on Oct 17, 2024

    @christopherfujino
    christopherfujino
    on Oct 17, 2024
    ContributorAuthor

    This is out to address: flutter/cocoon#3955

  9. auto-submit
    added a commit that references this issue on Oct 17, 2024

    //cipd_packages/codesign delete any .DS_Store files in archives (#3955)

    2e535f3

  10. christopherfujino commented on Oct 17, 2024

    @christopherfujino
    christopherfujino
    on Oct 17, 2024
    ContributorAuthor

    Ok, we have two new CIPD packages of codesign published:

    I now need to move the live ref

  11. christopherfujino commented on Oct 17, 2024

    @christopherfujino
    christopherfujino
    on Oct 17, 2024
    ContributorAuthor

    The first time I updated the live ref, I executed:

    cipd set-ref flutter/codesign/mac-amd64 -ref live -version SG027FIkNBc7L3Sggfv94iPFHXTWHGXGLyYKRnDRl04C
cipd set-ref flutter/codesign/mac-arm64 -ref live -version 8NisvNZ5P4cc03qlPVvrxlBXD4SvbfoBHSbsOFOrIJgC

    This time, it will be:

    cipd set-ref flutter/codesign/mac-amd64 -ref live -version YNJmqIY5w82rqxIA33c08Hh869zTLoomsQiR97qhLNsC
cipd set-ref flutter/codesign/mac-arm64 -ref live -version avtFuPUue13nyl19hgKYSxfJSVXDq0eO6IR6XFCVCP8C

    They both succeeded:

  12. christopherfujino commented on Oct 17, 2024

    @christopherfujino
    christopherfujino
    on Oct 17, 2024
    ContributorAuthor

    New build used the new codesign app, but appeared to fail exactly the same.

  13. jmagman commented on Oct 17, 2024

    @jmagman
    jmagman
    on Oct 17, 2024
    Member

    The codesigning build failure is complaining unsealed contents present in the root directory of an embedded framework I bet it's because the PrivacyInfo.xcprivacy file needs to be in the Resources directory on macOS (a different spot than iOS) flutter-team-archive/engine#55078

    I made a new macOS framework project, added an App Privacy file, and the copy step puts it in TestFramework.framework/Versions/A/Resources:

    builtin-copy -exclude .DS_Store -exclude CVS -exclude .svn -exclude .git -exclude .hg -resolve-src-symlinks /Users/m/Projects/TestFramework/PrivacyInfo.xcprivacy /Users/m/Library/Developer/Xcode/DerivedData/TestFramework-cazhopysvkdhedbgjtqzoiwsrxbt/Build/Products/Debug/TestFramework.framework/Versions/A/Resources

  14. cbracken commented on Oct 18, 2024

    @cbracken
    cbracken
    on Oct 18, 2024
    Member

    Ugh yeah that's what I was initially wondering when I noticed it in the dump in the logs, since it's the only new file we've embedded in there since the last release and it is at the root. That said, the .DS_Store thing seemed a bit more promising at the time based on StackOverflow, and on the assumption that Apple's code-signing tools would know about privacy manifests. Sounds like that was probably a bad assumption though.

  15. jmagman commented on Oct 18, 2024

    @jmagman
    jmagman
    on Oct 18, 2024
    Member

    The beta fix is at flutter-team-archive/engine#55938. The beta framework test #157136 should be merged first.

  16. 1 remaining item

  17. auto-submit
    added 2 commits that reference this issue on Oct 18, 2024

    Beta fix macos xcprivacy manifest copy location (#55938)

    af0f0d5

    Beta test alternate correct macOS framework xcprivacy manifest locati…

    077c008

  18. christopherfujino commented on Oct 18, 2024

    @christopherfujino
    christopherfujino
    on Oct 18, 2024
    ContributorAuthor

    The beta fix is at flutter/engine#55938. The beta framework test #157136 should be merged first.

    I think it will be ok merging this first, provided we merge the framework test before rolling the engine.

    It actually doesn't matter, I merged both.

  19. christopherfujino commented on Oct 18, 2024

    @christopherfujino
    christopherfujino
    on Oct 18, 2024
    ContributorAuthor

    I believe this is resolved since the engine builds succeeded. I'll leave this open until we roll it to the framework and the updated test passes.

  20. jmagman commented on Oct 22, 2024

    @jmagman
    jmagman
    on Oct 22, 2024
    Member

    Cherry-picking back to master so this doesn't regress in the next beta: flutter-team-archive/engine#56010 and #157318

  21. auto-submit
    added 2 commits that reference this issue on Oct 22, 2024

    Test alternate correct macOS framework xcprivacy manifest location (#…

    e38eb75

    Fix macos xcprivacy manifest copy location (#56010)

    2fad597
  22. christopherfujino
    added a commit that references this issue on Oct 23, 2024

    Beta test alternate correct macOS framework xcprivacy manifest locati…

    0cec633
  23. M97Chahboun
    added a commit that references this issue on Oct 30, 2024

    Test alternate correct macOS framework xcprivacy manifest location (f…

    ecd498f
  24. nick9822
    added a commit that references this issue on Dec 18, 2024

    Fix macos xcprivacy manifest copy location (flutter-team-archive/engi…

    2f467ba

  25. zhuhaichao518 commented on Feb 5, 2025

    @zhuhaichao518
    zhuhaichao518
    on Feb 5, 2025

    @jmagman You saved my day! PrivacyInfo.xcprivacy is exactly the file causing the problem in my case.

  26. cbracken commented on Feb 12, 2025

    @cbracken
    cbracken
    on Feb 12, 2025
    Member

    I believe this is resolved since the engine builds succeeded. I'll leave this open until we roll it to the framework and the updated test passes.

    Whoops! Better late than never -- closing!

  27. cbracken
    closed this as completedon Feb 12, 2025

  28. github-actions commented on Feb 26, 2025

    @github-actions
    github-actionsbot
    on Feb 26, 2025 – with GitHub Actions

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

  29. github-actions
    locked as resolved and limited conversation to collaborators on Feb 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions